Muthuramakrishnan Venkitasubramaniam

WORKSHOP: THEORY AND PRACTICE OF SECURE MULTIPARTY COMPUTATION

Adaptive UC from New Notions of Non-Malleability15 years of UC-Security [Canetti00]

25 years of Adaptive Security [Beaver89]

dynamic

Joint with Dana Dachman-Soled, Maryana Raykova, Tal Malkin

How can we achieve semi-honest2-party computation?

Y A O

O(1)-rnd

^

IDEALREAL

AR

AI

x2 y2 x2y2

Security by Comparison

x1 y1 x1 y1

“as correct & private as”Correctness: The output of every player is the same in real and ideal

Mesgs

Privacy: Mesgs can be generated from the simulator’s input & output

Simulator

IDEALREALConcurrent Security

many executions ofdifferent protocols

many executions with

independent trusted parties

Arbitrary network Arbitrary network

REAL WORLD IDEAL WORLD

Universal Composability [C]

ARAI

Simulate messages without honest input Independence of executions

Theorem [CF, CKL, L]: It is impossible to achieve UC-security for all “non-trivial functionalities”

What can we implement with UC- Security?

SOLUTION: Get some “limited” help from a trusted party

ORRelax definition of security

……

Static Corruption

Adaptive Corruption

corrupt in the beginning

corrupt adaptivelyduring execution

• Stronger definition of security Static security does not imply adaptive security

• Implies leakage resilience* [BCH12,NVZ13]

• Relevant to cloud security [RTSS09] Adaptively co-locate VMs Side channel attacks

Why Adaptive Security?

— Common Reference String [CLOS02,DN02,DG03,CPS07]

— Public Key Registration [BCNP04]

Trusted Setups

General Results in Adaptive UC-Security?

Relaxed Security— Super-Poly Time Simulation (SPS) [BS05]

What about Static UC-Security?

— Common Reference String [CLOS02,DN02,DG03,CPS07,DNO10]

— Public Key Registration [BCNP04,DNO10]

— Tamper-Proof Hardware [Kat07,CGS08,GISVW10]

— Timing Model [DNS98,KLP05]

Trusted Setups

What about Static UC-Security?

Relaxed Security— Super-Poly Time Simulation (SPS) [Pas03, BS05, GGJS12]

— Angel-based Security Model [PS04, MMY06,CLP10]

— Bounded (Player) Concurrent[Barak]

— Non-Uniform Simulation [LPV09]

— A unified framework to achieve security in any setup under minimal trusted infrastructure [LPV09]

— Can achieve security assuming only SA-OT [DNO10,LPV12]

Static Security :

State of the Art

Adaptive Security : — Construction only in a few trusted setups— Constructions based on specific assumptions such as dense

cryptosystems, trapdoor simulatable PKE— Require independent setups for every pair of parties, e.g

sunspots [CPS07]

UC-puzzleSimulation

Trusted SetupStand-Alone

Non-malleabiltyOne-Way Functions

Non-malleability

UC-Security

Achieving UC-Security - Static Case [LPV09]

Puzzle

Static Security :

Static OT Puzzle Static

UC

This work: When, and at what cost, can Adaptive UC security be acheived?

Achieving UC-Security - Static Case [LPV09,LPV12]

NMC

Static Security :

Ideally…

Adaptive Security :

Static OT Puzzle Static

UC

Adap. OT

Adap.Puzzle

Adap.UC

NMC

?

Static Security :

Our Work

Adaptive Security :

Static OT Puzzle Static

UC

Adap. OT

Adap.Puzzle

Adap.UC

NMC

?

Static Security :

Adaptive Security :

Static OT Puzzle Static

UC

Adap. OT

Adap.Puzzle

Adap.UC

Simul. PKE

Our Work

NMC

?

Static Security :

Adaptive Security :

Static OT Puzzle Static

UC

Adap. OT

Adap.Puzzle

Adap.UC

Simul. PKE

Our Work

NMC

NM*

Adaptive Security :

Adap. OT

Adap.Puzzle

Adap.UC

Simul. PKE

Our Work

Simulatable Public Key Encryption [DN00]• Oblivious Sampling of Public Keys/Ciphertexts• Invertable randomness for oblivious algs.=> Non-commiting Encryption [CFGN96,DN00]

NM*

Assuming existence of simulatable PKE, Adaptive UC-security is achievable in any

setup that admits an Adaptive Puzzle

Main Theorem

Previous results - simple corollaries Improved complexity assumptions

New models – non-uniform, bounded conc.

UC-puzzleAdap. Simulation

Trusted Setup

Adap. Non-malleability

Adaptive UC-Security

Achieving UC-Security - Adaptive Case

Cannot decouple! stand alone adaptivity requires setup

UC-puzzleAdap. Simulation

Trusted Setup

Adap. Non-malleability

Adaptive UC-Security

Achieving UC-Security - Adaptive Case

Adap. UC-Puzzle[LPV09] TODAY

Commitment SchemeThe “digital analogue” of sealed envelopes.

Com(v)

Decommitmentphase

v

v

Sender/committer Receiver

Hiding: The commitment hides the committed value

Commitmentphase

d

Binding: The commitment can only open to one value

Com(u)

MIM Attack on Commitments[DDN91]

Receiver/SenderSender Receiver

Com(u+1)

Man in the Middle

MIM ”mauls” left commitmentinto another to a related value

Non-Malleable w.r.t commitment[DDN91, PR05, LPV08]

i j ≠ i

IDEAL

REAL

Ci(u) Cj(v)

Simulator

MIM

Output v’ = v

Cj(v’)

Can construct O(1) round concurrent NMC w.r.t commitmentbased on OWFs [LP12,Goy12]

Non-Malleable w.r.t opening[CIO98,FF00,PR05]

i j ≠ i

IDEAL

REAL

Ci(u) Cj(v)

MIM

Cj(v’)

u v

u v'

Simulator

Can construct O(1) round stand-alone NMC w.r.t openingbased on CRHs for sychronized adversaries [PR05]

What we need?

Ci3(w) Cj1(v)

MIMw

v

Ci1(u)

uCi2(t)

tCi4(x)

xCi5(y)

y

Cj2(v’)

v'

Cj3(u’)

u'

Concurrent Non-Malleable Commitments w.r.t opening

Adaptively Secure

Concurrent Non-Malleable Commitments w.r.t opening

Adaptively Secure

MIM

Ci1(u)

u

Ci2(w)

w

Cj(v’)

v'…

… Simulator

u

w

Cj(v’)

v'

……

v’

Relaxation: Left commitments are i.i.d samples

Main Lemma: Assuming OWFs and Puzzle, O(n)-round Adaptively-secure Conc. NMC w.r.t opening and i.i.d samples

No additional trusted infrastructure to achieve non-malleability!

A single CRS/URS/sunspot is sufficient same gains as static case

Relaxation: Left commitments are i.i.d samples

“What is a few rounds of communication between friends”

i.e., Receiving Green does not help giving Orange and vice versa

Non-Malleable Sub-protocols

Ingredient I – Scheduling [DDN]

Ingredient I – Scheduling [DDN]

Can rewind the right without rewinding the left!

Id = 0 Id = 1

Simulation

Soundness

Challenger Solver

No Malicious Solver can output trapdoor after interaction

TRAPDOOR

NP-statement

Concurrent Adversary Challenger A, Simulator S that simulates all puzzles indistinguishably while

extracting the trapdoor

Puzzle

NP-witness

UC-

Ingredient II – Instance Based Comm. [LZ09]

W/O Trapdoor: Commitment is bindingWith Trapdoor: Reveal it to 0 and 1

UC-PuzzleNP-statement

Hamiltonian Circuit

Scheme: Commit to adjacency matrix

Commit 0 : Commit to true adjacency matrixCommit 1 : Commit to a simple cycleEquivocate : Commit to true adjacency matrix

Application: Conc. NM Coin Tossing

ANMCOM(r)

r'

r

Coin toss output = r+r’

IDEA FOR UC-COM: Create two URSSender to Receiver (URS1) – equivocate (using OWF)Receiver to Sender (URS2) – extract (using sim PKE)

Main TheoremAssuming existence of sim. PKE and Adap.UC Puzzle,

Adaptive UC-security is achievable

Assuming existence of OWFs and Adap.UC Puzzle, O(n)-round Adaptively-secure

Concurrent NMC w.r.t opening and i.i.d samples

Main Lemma

UC-Puzzle: Hard for Adversary to solve in real worldEasy for Simulator to obtain trapdoor

— Common Reference String [CLOS02,CPS07,CDPW07,DNO10]

— Public Key Registration [BCNP04,DNO10]

— Tamper-Proof Hardware [Kat07,CGS08,GISVW10]

— Timing Model [DNS98,KLP05]

Trusted Setups

Corollaries

Relaxed Security— Super-Poly Time Simulation (SPS) [Pas03, BS05, GGJS12]

— Angel-based Security Model [PS04, MMY06,CLP10]

— Bounded (Player) Concurrent[Barak, Goyal1, Goyal2]

— Non-Uniform Simulation [LPV09]

✓✓✓✓

✓

✓✓

Adaptive UC Security

Sim. PKE and PuzzleO(nd)-rounds(d = depth(C))

Not Everything! [IKOS10]

Static vs AdaptiveStatic UC Security

Assumptions SA-OT and PuzzleNECESS. And SUFF.

Rounds O(1)-rounds

What can we compute?

Any PPT computation

Conclusion

• Characterize when Adaptive UC is achievable• Next… Reduce complexity assumptions

– trapdoor simulatable PKE are suff. for NCE [CDMW09]– improve round complexity

• [Recent] UC-Adaptive Security in O(d)-rounds [V14]

• Angel Based UC-Security [PS04,CLP10,…]– reasonable model without any setup– implies SPS– linear-blowup in rounds with black-box tech. [GS12]

How can we achieve semi-honest2-party computation?

O(1)-rnd adaptive

^

… still open

THANKS